Live data from Hacker News

Show HN: AcrossTabs – Easy communication between cross-origin browser tabs

github.com

11–20 of 27 posts

Re: Show HN: AcrossTabs – Easy communication between cross-origin browser tabs

#13
post #4

Looks like a nice library, though using a default of `*` for Origin seems like an invitation for people to shoot themselves in the foot.

Yea, that's totally true. I would recommend using an origin property to be used every time an instance of the Library is created. Please refer: https://github.com/wingify/across-tabs#usage

Don't use unsafe defaults ffs, that's how things get exploited.

Re: Show HN: AcrossTabs – Easy communication between cross-origin browser tabs

#15

I think I understand what this does, but I don't think I understand the use case. Does anyone have any real-world examples of where this helps?

Yes, there are many. I'm a developer at Wingify, an A/B Testing tool and we are using this library I created a few days back. We have something called heatmaps - https://vwo.com/features/#heatmaps-clickmaps

To view a heatmap, user has to enter a URL, select date-range(Optional), and select the segmentation(eg. Direct, Referral, Location, Device, etc.)(optional).

A new tab is opened up with the specified URL each time on clicking the generate button.

So, let's say, you have to view heatmap of your site for:

1.The last week and only for those who live in US 2. The last week and only for those who uses Windows 3. The last month and who came directly to your site 4. The entire duration of the campaign and for all users

Now, for each configuration, there's an opened tab with the specified URL opened in it and the data for the requested segments and dates.

To pass on the data to and fro from one tab to another, and to track the status of all tabs(active/close), to notify other tabs when one gets closed, to notify all the children tabs when the opener tab gets closed, to send a message to a specific tab(eg. change segment) and to send a message to all tabs(eg. fetch data for new date applied), this library comes in handy. All this can be achieved with its simple API.

Hope you get the gist now.

Re: Show HN: AcrossTabs – Easy communication between cross-origin browser tabs

#16
post #8

I think I understand what this does, but I don't think I understand the use case. Does anyone have any real-world examples of where this helps?

If you build browser-based applications that open websites in new tabs and programatically interact with them then I imagine it'd be handy. I'm making a test builder to generate user scripts and e2e tests more easily, so having the app open in one tab talking to a site you're working with in another would be a possible use case. I've actually written my app as Chrome devtools extension though, so it already has acces…

Yea, that's a good use case you mentioned regarding the browser-build application.

Why we want this library, at Wingify, is something related to heatmaps and showing previews of changes made to the site in new tabs. Please read the detailed explanation I gave to @martin-adams in the above comment.

Re: Show HN: AcrossTabs – Easy communication between cross-origin browser tabs

#17
post #4

Earlier quoted context omitted.

Yea, that's totally true. I would recommend using an origin property to be used every time an instance of the Library is created. Please refer: https://github.com/wingify/across-tabs#usage

Don't use unsafe defaults ffs, that's how things get exploited.

Does that mean, the library should not act when an origin is not specified and throw some kinda message in the console?

How can it be enforced? Any suggestions?

Users can also make it a bit more complicated while using `*` to get hacked by accepting responses which match some kinda pattern(it's not bullet-proof though) and simply discarding others.

Re: Show HN: AcrossTabs – Easy communication between cross-origin browser tabs

#18
post #6
post #4

Earlier quoted context omitted.

Yea, that's totally true. I would recommend using an origin property to be used every time an instance of the Library is created. Please refer: https://github.com/wingify/across-tabs#usage

Then don't have a default that works without doing so. Really, defaults like this lead to "works, ship it" and totally unnecessary cases of vulnerable software.

Does that mean, the library should not act when an origin is not specified and throw some kinda message in the console?

Re: Show HN: AcrossTabs – Easy communication between cross-origin browser tabs

#19
post #6
post #4

Earlier quoted context omitted.

Yea, that's totally true. I would recommend using an origin property to be used every time an instance of the Library is created. Please refer: https://github.com/wingify/across-tabs#usage

Then don't have a default that works without doing so. Really, defaults like this lead to "works, ship it" and totally unnecessary cases of vulnerable software.

Reminds me mongodb being open/unprotected by default, that turned out well...
Post reply on HN